News for hackers. Stuff that matters.

A comment on Show HN: A notebook-style Common Lisp environment. Parent comment

Re:Show HN: A notebook-style Common Lisp environment by cadillackness on Saturday July 08, 2017 @04:24PM (#14727037)
I wouldn't recommend Slime to ANYONE because the developers do not care about security. The issue[0] of a gaping security hole has been open for going on two years.
[ Parent | on HN ]
Re:Show HN: A notebook-style Common Lisp environment by dasyatidprime on Saturday July 08, 2017 @06:13PM (#14727447)
Did you forget the link?
[ Parent | on HN ]
Re:Show HN: A notebook-style Common Lisp environment by PuercoPop on Saturday July 08, 2017 @07:53PM (#14727744)
They are talking about this issue

https://github.com/slime/slime/issues/286

If it has being left unaddressed because no one thinks it is enough of a problem. That is how free software works

[ Parent | on HN ]
Re:Show HN: A notebook-style Common Lisp environment by mbrock on Sunday July 09, 2017 @02:23AM (#14728625)
That actually scares me enough to disable Swank on my laptop. Actually, to disable all localhost services that could by any stretch of the imagination execute code.

Tl;dr: web sites can send requests to localhost TCP sockets despite origin restrictions using a trick called DNS rebinding.

[ Parent | on HN ]
Re:Show HN: A notebook-style Common Lisp environment by PuercoPop on Sunday July 09, 2017 @02:07PM (#14730904)
Yes, it certainly a gaping security hope. Yet I cant bring myself to submit a patch
[ Parent | on HN ]